[PATCH 4/5] resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)

[Andreas Schwab]

On Apr 30 2026, Florian Weimer wrote:

> @@ -532,9 +543,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
>  
>  		/* address suffix: provided only when prefix len != 128 */
>  		if (pbit < 128) {
> -			if (rdata + pbyte >= edata) goto formerr;
> +			unsigned int bytelen = sizeof(a) - pbyte;
> +			if (edata - rdata < bytelen) goto formerr;
>  			memset(&a, 0, sizeof(a));
> -			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
> +			memcpy(&a.s6_addr[pbyte], rdata, bytelen);
>  			if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
>  			  return -1;
>  			addlen(strlen(buf), &buf, &buflen);

bytelen should also replace the operand in the next line:

			rdata += sizeof(a) - pbyte;


-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."